# How are you authenticating Discourse to AWS? Help us improve the settings!

**URL:** https://meta.discourse.org/t/how-are-you-authenticating-discourse-to-aws-help-us-improve-the-settings/385039
**Category:** Feature
**Tags:** s3
**Created:** [8 oktober 2025 om 15:16 UTC](https://meta.discourse.org/t/how-are-you-authenticating-discourse-to-aws-help-us-improve-the-settings/385039 "2025-10-08T15:16:04Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [9 oktober 2025 om 22:15 UTC](https://meta.discourse.org/t/how-are-you-authenticating-discourse-to-aws-help-us-improve-the-settings/385039/4 "2025-10-09T22:15:20Z")

</div>

> [@ducks](#):
>
> when credentials should come from the environment vs. site settings

This may sound nitpicking but I think there are some important nuances here.  
The options that you provide are a mixture of HOW settings are being passed and WHAT settings are being passed.

With respect to HOW settings are being passed, two things apply:

1. the way environment variables are currently being used

The `DISCOURSE_WHATEVER` environment variables are currently used during the Docker build process to create entries in `discourse.conf` which are available as `GlobalSetting` or `SiteSetting` from within Discourse. Discourse does not perceive these environment variables as such.

1. the limitations of discourse.conf entries

Although GlobalSettings have the neat treat of being able to suppress and override SiteSettings, they also impose the limitation that in multisite enviroments they apply to all sites in the multisite.

These two combined mean that from within Discourse, SiteSetting is the most flexible. They can be actual SiteSettings, those can optionally come from `discourse.conf` and those entries can come from `DISCOURSE_` environment variables. IMO there is _no actual choice_ there, SiteSetting is the most flexible and does not have disadvantages since they’re a functional superset of the others. You can use GlobalSettings instead if you want, and those could be filled using environment variables.

That implies that the only actual choice is whether to use automatic discovery of credentials or not. In my personal perception, automatic discovery is always very prone to errors, so I would prefer to have something explicit.

I.e. have a SiteSetting that somehow points to actual, concrete, credentials.

---

_[View the full topic](https://meta.discourse.org/t/how-are-you-authenticating-discourse-to-aws-help-us-improve-the-settings/385039)._